Security is not a product, but a process.

learn more… | top users | synonyms (2)

0
votes
1answer
46 views

Configure Apache to allow the access for the specific URL under VPN [closed]

Here is the case, I want to configure the Apache server so that some of the URLs can be accessed under VPN and some of them should be accessible with/without VPN. Here is my scenario Without VPN ...
1
vote
1answer
49 views

Secure installation of KVM VPS?

I'm going to install Debian Wheezy on a KVM VPS. VNC access to console is enabled, and by sniffing network traffic when connecting, I see VNC password is encrypted but everything else is sent in plain ...
0
votes
1answer
81 views

LDAP throws Event ID 2887 warnings even after enabling “require signing”

I am running an AD LDS directory and, ever since configuring it, I have been seeing 2887 warning messages, so I have decided to follow this guide to have the server require LDAP signing. The problem ...
-6
votes
1answer
49 views

Change original port number [closed]

The default port number for ssh is 22 is there a way to implement security by being obscure and changing the original number? So for example ssh would not be on port 22 it would be on lets say 2847.
0
votes
2answers
53 views

Dealing with Apache spam

I am recieving a lot of suspicious requests which cause Apache to use a lot of memory (over 1GB) [Mon Feb 24 09:48:29 2014] [error] [client 120.37.238.125] PHP Fatal error: Allowed memory size of ...
0
votes
1answer
39 views

what would happen when macchanger to gateway mac address? [closed]

I thought arpspoof GATEWAY_IP -t VICTIM_IP can be prevented by add a static arp entry on victim side, i.e. arp -s GATEWAY_IP GATEWAY_MAC I read ...
0
votes
0answers
39 views

Mail Server: Postfix & Dovecot Security

For the fist time I decided to configure my own email server on a VPS from the scratch, I've been following some guides and doing some research but I've some doubts about the security of my Postfix ...
-1
votes
1answer
41 views

Misuse of the statistics script of Plesk?

I downloaded the log file from the web server, and found many strange entries. Why is a statistics script called so terribly often? What do all the junk referrers do there? Looks like some ...
0
votes
3answers
80 views

Is it a good idea to only allows connections to be established in the LAN->DMZ direction?

I'm trying to setup the usual thing, with a DMZ containing servers that can be accessed from the internet, and a LAN that should be as secure as possible. I happen to also have total freedom on the ...
0
votes
0answers
21 views

Encrypt MySQL column with ssh-key forwarded by ssh-agent

I would like to keep sensitive data such as user's e-mail address in MySQL database in encrypted form. Is it possible to encrypt/decrypt mail column in MySQL using ssh-key forwarded by ssh-agent on ...
0
votes
1answer
31 views

Changing file permissions on web server to follow Least Privilege Security Principle: chmod 750 -R /

I'm not sure what details are relevant, but here is some general context. I'm configuring a Ubuntu 12.04 web server on AWS to process customer payment info before redirecting them to a hosted ...
0
votes
1answer
140 views

Workaround needed to run FileMaker Server 12 Admin Console with the new Java security model

As of Java 7 update 51 (7u51), there is a requirement for a new Permissions attribute (introduced in 7u25) that prevents the FileMaker Server 12 Admin Console from running. This also affects the ...
0
votes
2answers
72 views

Block a Non-ActiveSync Device from accessing Exchange 2010

We're trying to tighten security, and block users from accessing our mail server without having the proper MDM on their phones. With programs like Aqua Mail and CloudMagic, it seems like they go ...
0
votes
0answers
43 views

Chroot master process Nginx 1.2.1

I want to install nginx not current stable version but in one currently deposits, and chroot the process. I followed some tutorials including: Securing Debian Manual Appendix H - Chroot environment ...
3
votes
2answers
37 views

sshd logging attempts to login without a private key

On my VPS, running Debian 7, I have ssh enabled on the default port 22 with only private key authentication enabled, all other ports are filtered with iptables. I am frequently getting login attempts ...
2
votes
0answers
29 views

How to set permissions for www/dir and make sure no security threats arise

I've a peculiar situation. I've VPS that I use for my own projects. A friend of mine asked me to host his wordpress blog. Now I've setup my VPS very straightforward, all projects are under /www and ...
1
vote
3answers
270 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
-4
votes
1answer
32 views

Is it possible to have multiple domain policy for different servers? [closed]

In my organization, there is 1 domain with 13 production servers joined to it. Recently, we realized that the default domain policy that is applied to the production servers have minimal security ...
2
votes
1answer
86 views

OpenSSL missing cipher

I'm trying to configure proper setup for my HTTPS server and I am have a little trouble with IE8@WinXP. This platform has a very poor support for TLS siphers: ...
2
votes
0answers
42 views

How can I find a security group's dependencies? [duplicate]

There is a similar question that didn't receive a proper answer. How can I find a security group's dependencies? These include EC2 instances, but other services also create dependencies, like the ...
0
votes
2answers
127 views

Allow service to interact with desktop

DC OS - Windows Server 2008 R2 Std Client OS - Windows XP, Windows 7 I have implemented Security policy through Network Policy Server and enabled Wired AutoConfig Services Automatically. While ...
1
vote
1answer
72 views

How to hide Folders for FTP user jailed to user home

Setup: VSFTPD FTP server Only the FTP user has access to FTP User home modded to /var/www User now has write access only to /var/www User still can browse folder structure - this is what i want ...
-2
votes
1answer
156 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [duplicate]

As part of hardening a standalone/dedicated MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL ...
-1
votes
1answer
81 views

Windows: View other network shares without sharing anything myself [closed]

Using windows, I would like to be able to browse computers and their shares on the network, without publishing any shares, administrative shares, and not even having my computer listed in the ...
13
votes
3answers
623 views

Force authenticated user immediate logoff (emergency case)

In Active Directory if you want to prevent a user from logging in you can either disable their account or simply reset their password. However, if you have a user who is already logged in to a ...
0
votes
2answers
74 views

Does /etc/fstab need to be world readable?

I would like to put network share mounts in /etc/fstab, but by default that file is world-readable which allows everyone to read the credentials I put into the mount options. Is it safe to make ...
1
vote
0answers
25 views

IIS application pool identity doesn't respect Windows security

I am using Windows 2012 and have configured my IIS application pool to use my own 'XXXWeb' account. My website is using the correct application pool (the W3WP process is also running as 'XXXWeb'). I ...
1
vote
1answer
45 views

Domain admin accounts can do less than domain administrator account

On a Windows 2008R2 server, a domain admin account has lesser rights than the domain administrator account. For example, the domain admin account can't install a service or create a file on the root ...
0
votes
0answers
24 views

Are there security concerns involved with keepalive?

I'm configuring an IIS7 site for a third-party tool, and our team had a brief discussion about the keepalive setting. I have learned in my research that increasing this timeout will impact available ...
24
votes
7answers
2k views

Is it best practices to have separate login for a domain for domain admins?

I typically like to set up separate logins for myself, one with regular user permissions, and a separate one for administrative tasks. For example, if the domain was XXXX, I'd set up a XXXX\bpeikes ...
9
votes
6answers
545 views

What are the pros/cons of blocking a program from running in %appdata%, %temp%, etc.?

While researching ways to prevent CryptoLocker, I saw a forum post that advised using Group Policy Objects (GPO) and/or antivirus software to block run access in the following locations: %appdata% ...
1
vote
1answer
78 views

AWS: network ACL blocks outbound traffic

I am implementing a REST service in Amazon AWS. The internal servlets listen on numerous ports like 8080 and 9000, and an Apache configured as a reverse proxy serves them with proper URL schema using ...
0
votes
1answer
36 views

Protect public directories from download via wget and curl

My users upload their profile images and I save them in a public folder. The file names are not predictable (they are based on md5 hash of user id with salt). When someone views the user's profile, ...
25
votes
8answers
5k views

Block employee access to public cloud

First of all, let me state that this is not my idea and I don't want to discuss whether such an action is reasonable. However, for a company, is there a way to prevent employees to access public ...
2
votes
3answers
172 views

To add security to SSH-keys from Man-in-middle-attacks [closed]

I would like to get Mobile-phone verification or something else besides the SSH-key verification. How can you add defence to the SSH-keys?
0
votes
1answer
42 views

Is a VPN right for restricting server access?

I would like to set up a Few QA servers for a web application, under the app domain, however I would not like these servers to be accessible to just everyone from the Internet. Ideally, the QA team ...
2
votes
3answers
125 views

Docker: How to partition a large server?

So I have a Dell XS23 Rack with 8 CPUs and 40G Ram with vmware esxi in my production environment. The way I'd partitioned it before was 2 API servers (quad core, 8gig ram) 2 DB servers same specs, ...
2
votes
2answers
68 views

What are the security issues in creating a firewall between two subnets?

As I understand it, the hosts on different subnets cannot communicate with each other unless there is a router somewhere on both subnets that forwards traffic between them. I have have two subnets ...
-1
votes
1answer
21 views

Site security - how to filter incoming traffic to a specific port

Just ran a security test on ScanMyServer.com, the results showed a medium risk vulnerability: Database Reachable from the Internet Summary: The remote host is running a database server that is ...
0
votes
1answer
36 views

DDoS Attack Mitigation Techniques [duplicate]

Our hosting is set up on Amazon EC2 servers, which have been performing great. The problem we run into are spikes in requests for invalid URLs from scripts/bots looking for security holes. When ...
1
vote
0answers
19 views

Dynamics Business Portal [closed]

I have installed SharePoint 2010, Dynamics Business Portal Version 6.0.1053.0. When I try to log on to the BP site I get the error given below: ...
0
votes
1answer
46 views

Traffic in a AWS virtual private cloud

On Amazon AWS, should I encrypt sensitive traffic between instances in a virtual private cloud? More specifically, is the traffic between the instances in such a VPC private as in a virtual network, ...
0
votes
1answer
33 views

removing process (and child process) access to file systems? [closed]

is there a unix-type free OS that allows me to remove all disk access for a specific process and any of its children? #!/usr/bin/perl -w use strict; use Perl6::Slurp; my $infile= ...
1
vote
0answers
25 views

Won't keychain --clear in .bash_profile interfere with cron jobs?

Keychain tutorials recommend adding /usr/bin/keychain --clear to ~/.bash_profile to only allow cron jobs to use passwordless login. I'm not sure I understand how this works. If I take it right, the ...
0
votes
0answers
33 views

Why AD DS user is able to write to ADLDS(ADAM) container(user is neither imported nor added as foreignsecurityprincipal)?PS/dsacls cmd to fix it-DENY

I have installed 'AD LDS' instance on one of my windows server 2012 which is part of a domain. I brought few users (windows security principals to 'AD LDS') as 'ForeignSecurityPrincipals' from AD DS ...
0
votes
1answer
44 views

Is the following setuid program a security risk?

I have the following program in .c set as setuid chmod only read/execute by owner and will set it immutable, as i will the php script it invokes. #include <stdio.h> #include <stdlib.h> ...
-2
votes
2answers
103 views

List of TCP & UDP ports known to be used by malware, etc [closed]

Where can I find a regularly updated, downloadable list of TCP & UDP ports that are known to be commonly used by malware, trojans, etc.? This is for import into an IT asset management system to ...
1
vote
1answer
72 views

When is a user considered “Everyone” in the “Access this computer from the network” policy

I am a bit puzzled by the existance of the "Everyone" group in this policy. Per http://technet.microsoft.com/en-us/magazine/dd637754.aspx: The Everyone identity All interactive, network, dial-up, ...
1
vote
1answer
46 views

Logging in iptables

I have created rules in iptables to log and edited the rsyslog.conf file to output any message which contains "iptables" to a different log file. It seems that it is logging to both places, the ...
1
vote
2answers
173 views

Web server atack DDOS

I have a server (vps) to use as a repository and testing (gitlab and redmine) server. However apache crashed, seeing the /var/log/apache2/error.log have many errors of this type: [Fri Jan 31 ...